[NETFILTER]: nf_conntrack: properly use RCU API for nf_ct_protos/nf_ct_l3protos arrays (923f4902) · Commits · e / devices / android_kernel_fairphone_FP4

include/net/netfilter/nf_conntrack_l3proto.h

+1 −1

Original line number	Original line	Diff line number	Diff line
	@@ -106,7 +106,7 @@ __nf_ct_l3proto_find(u_int16_t l3proto)
	{		{
	if (unlikely(l3proto >= AF_MAX))		if (unlikely(l3proto >= AF_MAX))
	return &nf_conntrack_l3proto_generic;		return &nf_conntrack_l3proto_generic;
	return nf_ct_l3protos[l3proto];		return rcu_dereference(nf_ct_l3protos[l3proto]);
	}		}

	#endif /_NF_CONNTRACK_L3PROTO_H/		#endif /_NF_CONNTRACK_L3PROTO_H/

net/ipv4/netfilter/nf_conntrack_proto_icmp.c

+2 −0

Original line number	Original line	Diff line number	Diff line
	@@ -170,7 +170,9 @@ icmp_error_message(struct sk_buff *skb,
	return -NF_ACCEPT;		return -NF_ACCEPT;
	}		}

			/* rcu_read_lock()ed by nf_hook_slow */
	innerproto = __nf_ct_l4proto_find(PF_INET, inside->ip.protocol);		innerproto = __nf_ct_l4proto_find(PF_INET, inside->ip.protocol);

	dataoff = skb->nh.iph->ihl*4 + sizeof(inside->icmp);		dataoff = skb->nh.iph->ihl*4 + sizeof(inside->icmp);
	/* Are they talking about one of our connections? */		/* Are they talking about one of our connections? */
	if (!nf_ct_get_tuple(skb, dataoff, dataoff + inside->ip.ihl*4, PF_INET,		if (!nf_ct_get_tuple(skb, dataoff, dataoff + inside->ip.ihl*4, PF_INET,

net/ipv4/netfilter/nf_nat_core.c

+5 −4

Original line number	Original line	Diff line number	Diff line
	@@ -429,6 +429,7 @@ int nf_nat_icmp_reply_translation(struct nf_conn *ct,
	struct icmphdr icmp;		struct icmphdr icmp;
	struct iphdr ip;		struct iphdr ip;
	} *inside;		} *inside;
			struct nf_conntrack_l4proto *l4proto;
	struct nf_conntrack_tuple inner, target;		struct nf_conntrack_tuple inner, target;
	int hdrlen = (pskb)->nh.iph->ihl 4;		int hdrlen = (pskb)->nh.iph->ihl 4;
	enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);		enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
	@@ -464,16 +465,16 @@ int nf_nat_icmp_reply_translation(struct nf_conn *ct,
	DEBUGP("icmp_reply_translation: translating error %p manp %u dir %s\n",		DEBUGP("icmp_reply_translation: translating error %p manp %u dir %s\n",
	*pskb, manip, dir == IP_CT_DIR_ORIGINAL ? "ORIG" : "REPLY");		*pskb, manip, dir == IP_CT_DIR_ORIGINAL ? "ORIG" : "REPLY");

			/* rcu_read_lock()ed by nf_hook_slow */
			l4proto = __nf_ct_l4proto_find(PF_INET, inside->ip.protocol);

	if (!nf_ct_get_tuple(*pskb,		if (!nf_ct_get_tuple(*pskb,
	(pskb)->nh.iph->ihl4 + sizeof(struct icmphdr),		(pskb)->nh.iph->ihl4 + sizeof(struct icmphdr),
	(pskb)->nh.iph->ihl4 +		(pskb)->nh.iph->ihl4 +
	sizeof(struct icmphdr) + inside->ip.ihl*4,		sizeof(struct icmphdr) + inside->ip.ihl*4,
	(u_int16_t)AF_INET,		(u_int16_t)AF_INET,
	inside->ip.protocol,		inside->ip.protocol,
	&inner,		&inner, l3proto, l4proto))
	l3proto,
	__nf_ct_l4proto_find((u_int16_t)PF_INET,
	inside->ip.protocol)))
	return 0;		return 0;

	/* Change inner back to look like incoming packet. We do the		/* Change inner back to look like incoming packet. We do the

net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c

+1 −0

Original line number	Original line	Diff line number	Diff line
	@@ -182,6 +182,7 @@ icmpv6_error_message(struct sk_buff *skb,
	return -NF_ACCEPT;		return -NF_ACCEPT;
	}		}

			/* rcu_read_lock()ed by nf_hook_slow */
	inproto = __nf_ct_l4proto_find(PF_INET6, inprotonum);		inproto = __nf_ct_l4proto_find(PF_INET6, inprotonum);

	/* Are they talking about one of our connections? */		/* Are they talking about one of our connections? */

net/netfilter/nf_conntrack_core.c

+21 −6

Original line number	Original line	Diff line number	Diff line
	@@ -332,13 +332,16 @@ destroy_conntrack(struct nf_conntrack *nfct)
	/* To make sure we don't get any weird locking issues here:		/* To make sure we don't get any weird locking issues here:
	* destroy_conntrack() MUST NOT be called with a write lock		* destroy_conntrack() MUST NOT be called with a write lock
	* to nf_conntrack_lock!!! -HW */		* to nf_conntrack_lock!!! -HW */
			rcu_read_lock();
	l3proto = __nf_ct_l3proto_find(ct->tuplehash[IP_CT_DIR_REPLY].tuple.src.l3num);		l3proto = __nf_ct_l3proto_find(ct->tuplehash[IP_CT_DIR_REPLY].tuple.src.l3num);
	if (l3proto && l3proto->destroy)		if (l3proto && l3proto->destroy)
	l3proto->destroy(ct);		l3proto->destroy(ct);

	l4proto = __nf_ct_l4proto_find(ct->tuplehash[IP_CT_DIR_REPLY].tuple.src.l3num, ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.protonum);		l4proto = __nf_ct_l4proto_find(ct->tuplehash[IP_CT_DIR_REPLY].tuple.src.l3num,
			ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.protonum);
	if (l4proto && l4proto->destroy)		if (l4proto && l4proto->destroy)
	l4proto->destroy(ct);		l4proto->destroy(ct);
			rcu_read_unlock();

	if (nf_conntrack_destroyed)		if (nf_conntrack_destroyed)
	nf_conntrack_destroyed(ct);		nf_conntrack_destroyed(ct);
	@@ -647,9 +650,14 @@ struct nf_conn nf_conntrack_alloc(const struct nf_conntrack_tuple orig,
	const struct nf_conntrack_tuple *repl)		const struct nf_conntrack_tuple *repl)
	{		{
	struct nf_conntrack_l3proto *l3proto;		struct nf_conntrack_l3proto *l3proto;
			struct nf_conn *ct;

			rcu_read_lock();
	l3proto = __nf_ct_l3proto_find(orig->src.l3num);		l3proto = __nf_ct_l3proto_find(orig->src.l3num);
	return __nf_conntrack_alloc(orig, repl, l3proto, 0);		ct = __nf_conntrack_alloc(orig, repl, l3proto, 0);
			rcu_read_unlock();

			return ct;
	}		}
	EXPORT_SYMBOL_GPL(nf_conntrack_alloc);		EXPORT_SYMBOL_GPL(nf_conntrack_alloc);

	@@ -817,7 +825,9 @@ nf_conntrack_in(int pf, unsigned int hooknum, struct sk_buff **pskb)
	return NF_ACCEPT;		return NF_ACCEPT;
	}		}

			/* rcu_read_lock()ed by nf_hook_slow */
	l3proto = __nf_ct_l3proto_find((u_int16_t)pf);		l3proto = __nf_ct_l3proto_find((u_int16_t)pf);

	if ((ret = l3proto->prepare(pskb, hooknum, &dataoff, &protonum)) <= 0) {		if ((ret = l3proto->prepare(pskb, hooknum, &dataoff, &protonum)) <= 0) {
	DEBUGP("not prepared to track yet or error occured\n");		DEBUGP("not prepared to track yet or error occured\n");
	return -ret;		return -ret;
	@@ -872,10 +882,15 @@ EXPORT_SYMBOL_GPL(nf_conntrack_in);
	int nf_ct_invert_tuplepr(struct nf_conntrack_tuple *inverse,		int nf_ct_invert_tuplepr(struct nf_conntrack_tuple *inverse,
	const struct nf_conntrack_tuple *orig)		const struct nf_conntrack_tuple *orig)
	{		{
	return nf_ct_invert_tuple(inverse, orig,		int ret;

			rcu_read_lock();
			ret = nf_ct_invert_tuple(inverse, orig,
	__nf_ct_l3proto_find(orig->src.l3num),		__nf_ct_l3proto_find(orig->src.l3num),
	__nf_ct_l4proto_find(orig->src.l3num,		__nf_ct_l4proto_find(orig->src.l3num,
	orig->dst.protonum));		orig->dst.protonum));
			rcu_read_unlock();
			return ret;
	}		}
	EXPORT_SYMBOL_GPL(nf_ct_invert_tuplepr);		EXPORT_SYMBOL_GPL(nf_ct_invert_tuplepr);